Splunk Search

problem with addcoltotals

abhayneilam
Contributor

Hi,

I have a file like :

XXXX 20
YYYY 40
ZZZZ 60

I am running a query ....|addcoltotals

I am getting :
XXXX 20
YYYY 40
ZZZZ 60
120

but I also want to mention Grand_Total in the first field as I want my output like :

XXXX 20
YYYY 40
ZZZZ 60
Total 120

"Total" String should come...

Please help !!

Thanks in Advance

0 Karma
1 Solution

jonuwz
Influencer

An example :

 * | stats count by sourcetype | addcoltotals labelfield=sourcetype label="Total"

labelfield is the column you want the label to appear in

label is the text in the labelfield.

View solution in original post

tmnteam
Engager

Hello,

I have a search with a "stats [...] by _time" at the end. (with a bin span=hour)

I have tried with labelfield=_time but it doesn't work (value is 0NaN-NaN-NaN NaN:NaN:NaN)

Is it possible to remap this label?

Thank you in advance.

0 Karma

somesoni2
Revered Legend

Since _time is in the epoch format (after your query) and with addtotal, you're trying to add a row with _time="Total" (not a valid date format).

0 Karma

jonuwz
Influencer

An example :

 * | stats count by sourcetype | addcoltotals labelfield=sourcetype label="Total"

labelfield is the column you want the label to appear in

label is the text in the labelfield.

Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...